While CFWebstore allows the use of Shared SSL, it’s recommended you purchase your own secure certificate which looks more professional, doesn’t cost much (from places like GoDaddy.com), and is necessary for PCI Compliance due to security issues with passing session IDs on the URL (see the security section below for more information). However if you want to use Shared SSL for prototyping a site, or otherwise don’t need your own certificate, be very diligent about any store links you create yourself, in your layouts and menus. They MUST have the request variables added on the end to properly maintain sessions. For any links that start with ‘Request.SecureURL’, use Request.AddToken on the end, and for any that start with ‘Request.StoreURL’ (or nothing) use the Request.Token2.